Getting Data In

Multiline events with fields with same name (Windows 2008 logs)

bojanz
Communicator

With Windows 2008 (and Vista) event logs are now much more detailed, however there are some problems with multiple fields which have same names, for example like this:

Subject:  
    Security ID:        S-1-5-18  
    Account Name:       CALLISTO$  
    Account Domain:     DEMO  
    Logon ID:       0x3e7  

Logon Type:         10  

Account For Which Logon Failed:  
    Security ID:        S-1-0-0  
    Account Name:       Administrator  
    Account Domain:     DEMO  

Now, I want to extract only the second "Account Name" field. Splunk automatically extracts both of them, but I want to graph only the second. Any idea how to do it on multiline events like this? I tried with rex and regex but with no success 😞

Thanks.

1 Solution

Lowell
Super Champion

You may be able to prevent splunk from extracting the first value, but there may be times when you'll want the first value but not the second. So perhaps an easier way would be to tell splunk just to grab that second value for your search. Since you always know that you want the second value, you can use an eval statement in your search like this:

sourcetype=WinEventLog:Security "Logon Failed" | eval login_account=mvindex(Account_Name,1) | timechart count by login_account

View solution in original post

Lowell
Super Champion

You may be able to prevent splunk from extracting the first value, but there may be times when you'll want the first value but not the second. So perhaps an easier way would be to tell splunk just to grab that second value for your search. Since you always know that you want the second value, you can use an eval statement in your search like this:

sourcetype=WinEventLog:Security "Logon Failed" | eval login_account=mvindex(Account_Name,1) | timechart count by login_account

bapruski
Explorer

How would you evaluate the Account_Name if in some cases it has only one value (event 4768, 4769) and in some it has two (event 4624)?

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...